Skip to main content

Exporting audit log activity for your enterprise

You can export audit and Git events data to a file for offline analysis.

Enterprise owners can export the audit log.

About exports of audit log and Git events data

You can export the audit log by downloading a JSON or CSV file from your enterprise on GitHub Enterprise Cloud. When you export audit log events, you can query by one or more of these supported qualifiers to filter for specific log events to export. For more information about search qualifiers, see "Search based on the action performed."

You can export Git events data by downloading a JSON file from your enterprise audit log. Unlike audit log data, you cannot query for specific Git events to filter and export in the audit log user interface.

Note: When you export Git events, events that were initiated via the web browser or the REST or GraphQL APIs are not included. For example, when a user merges a pull request in the web browser, changes are pushed to the base branch, but the Git event for that push is not included in the export.

After you export the log, you'll see the following keys and values in the resulting file.

KeyExample value
actionteam.create
actoroctocat
usercodertocat
actor_location.country_codeUS
orgocto-org
repoocto-org/documentation
created_at1429548104000 (Timestamp shows the time since Epoch with milliseconds.)
data.emailoctocat@nowhere.com
data.hook_id245
data.events["issues", "issue_comment", "pull_request", "pull_request_review_comment"]
data.events_were["push", "pull_request", "issues"]
data.target_loginoctocat
data.old_userhubot
data.teamocto-org/engineering

As an alternative to exporting log events, you can use the API to retrieve audit log events, or set up GitHub Enterprise Cloud to stream audit data as events are logged. For more information, see "Using the audit log API for your enterprise" and "Streaming the audit log for your enterprise."

Exporting audit log data

  1. In the top-right corner of GitHub.com, click your profile photo, then click Your enterprises. "Your enterprises" in drop-down menu for profile photo on GitHub Enterprise Cloud

  2. In the list of enterprises, click the enterprise you want to view. Name of an enterprise in list of your enterprises

  3. In the enterprise account sidebar, click Settings. Settings tab in the enterprise account sidebar

  4. Under " Settings", click Audit log. Audit log tab in the enterprise account sidebar

  5. Optionally, to only export filtered results, search by one or more supported qualifiers or log filters.

  6. Select the Export dropdown menu, and choose the file format (JSON or CSV) to export log events in.

    Export button

Exporting Git events data

You can also export Git events data by date range.

  1. In the top-right corner of GitHub.com, click your profile photo, then click Your enterprises. "Your enterprises" in drop-down menu for profile photo on GitHub Enterprise Cloud

  2. In the list of enterprises, click the enterprise you want to view. Name of an enterprise in list of your enterprises

  3. In the enterprise account sidebar, click Settings. Settings tab in the enterprise account sidebar

  4. Under " Settings", click Audit log. Audit log tab in the enterprise account sidebar

  5. Select the Export Git Events dropdown menu and choose a date range to export log events for.

    Export Git events button

  6. Click Download Results to download the file.

  7. The data is exported as a compressed JSON file. To extract the JSON data, uncompress the file using an archive utility client or command. For example:

    gunzip export-avocado-corp-1642896556.json.gz